---
title: Webhooks
url: https://platform.claude.com/docs/en/api/php/beta/organization/webhooks
---

# Webhooks

## Create Organization Webhook Endpoint

`$client->beta->organization->webhooks->create(list<EnabledEvent> enabledEvents, string url, ?string description, ?string name, ?list<AnthropicBeta> betas): NewOrganizationWebhookEndpoint`

**POST** `/v1/organizations/webhooks`

Create an organization webhook endpoint.

An organization webhook endpoint belongs to the organization rather than to one of its workspaces. An organization can have at most 32 organization
webhook endpoints, enabled or disabled.

The response includes the endpoint's signing secret. No read returns it, so store
it when you receive it.

Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled.

### Parameters

- `enabledEvents: list<EnabledEvent>`

  The event types to deliver to the endpoint. Must list at least one.

- `url: string`

  The HTTPS URL that deliveries are sent to.

- `description?: optional string`

  Notes about the endpoint.

- `name?: optional string`

  A short label for the endpoint.

- `betas?: optional list<AnthropicBeta>` (header parameter)

  This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header.

### Returns

- `class NewOrganizationWebhookEndpoint`

  - `string id`

    ID of the webhook endpoint.

  - `\Datetime createdAt`

    When the endpoint was created, in RFC 3339 format.

  - `string description`

    Notes about the endpoint. An empty string when none were given.

  - `string disabledReason`

    Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it.

  - `list<EnabledEvent> enabledEvents`

    The event types delivered to the endpoint.

  - `string name`

    A short label for the endpoint. An empty string when none was given.

  - `string signingSecret`

    The secret Anthropic signs deliveries to the endpoint with (prefix `whsec_`). No other response returns it, so store it now. To replace it, regenerate the signing secret.

  - `OrganizationWebhookEndpointState state`

    Whether deliveries are sent to the endpoint.

  - `\Datetime updatedAt`

    When the endpoint was last changed, in RFC 3339 format.

  - `string url`

    The HTTPS URL that deliveries are sent to.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Beta\AnthropicBeta;

$client = new Client(apiKey: 'my-anthropic-api-key');

$betaNewOrganizationWebhookEndpoint = $client
  ->beta
  ->organization
  ->webhooks
  ->create(
  enabledEvents: ['user_profile.enforcement_action_opened'],
  url: 'x',
  description: 'description',
  name: 'name',
  betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24],
);

var_dump($betaNewOrganizationWebhookEndpoint);
```

#### Response (200)

```json
{
  "id": "id",
  "created_at": "2019-12-27T18:11:19.117Z",
  "description": "description",
  "disabled_reason": "disabled_reason",
  "enabled_events": [
    "user_profile.enforcement_action_opened"
  ],
  "name": "name",
  "signing_secret": "signing_secret",
  "state": "disabled",
  "updated_at": "2019-12-27T18:11:19.117Z",
  "url": "url"
}
```

## List Organization Webhook Endpoints

`$client->beta->organization->webhooks->list(?string afterID, ?string beforeID, ?int limit, ?Order order, ?list<AnthropicBeta> betas): Page<OrganizationWebhookEndpoint>`

**GET** `/v1/organizations/webhooks`

List the organization's webhook endpoints.

An organization webhook endpoint belongs to the organization rather than to one of its workspaces. The list does not include webhook endpoints that
belong to a workspace.

Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled.

### Parameters

- `afterID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?: optional string` (query parameter)

  ID of a webhook endpoint to use as a cursor. Returns the first `limit` endpoints that come before it in list order, not the `limit` endpoints just before it.

- `limit?: optional int` (query parameter)

  Number of items to return per page, up to `100`. The default, `0`, means `20`.

  default: 0

- `order?: optional Order` (query parameter)

  Sort order by `created_at`. Defaults to `desc`, newest first.

- `betas?: optional list<AnthropicBeta>` (header parameter)

  This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header.

### Returns

- `class OrganizationWebhookEndpoint`

  - `string id`

    ID of the webhook endpoint.

  - `\Datetime createdAt`

    When the endpoint was created, in RFC 3339 format.

  - `string description`

    Notes about the endpoint. An empty string when none were given.

  - `string disabledReason`

    Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it.

  - `list<EnabledEvent> enabledEvents`

    The event types delivered to the endpoint.

  - `string name`

    A short label for the endpoint. An empty string when none was given.

  - `OrganizationWebhookEndpointState state`

    Whether deliveries are sent to the endpoint.

  - `\Datetime updatedAt`

    When the endpoint was last changed, in RFC 3339 format.

  - `string url`

    The HTTPS URL that deliveries are sent to.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Beta\AnthropicBeta;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->beta->organization->webhooks->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  limit: 0,
  order: 'asc',
  betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24],
);

var_dump($page);
```

#### Response (200)

```json
{
  "data": [
    {
      "id": "id",
      "created_at": "2019-12-27T18:11:19.117Z",
      "description": "description",
      "disabled_reason": "disabled_reason",
      "enabled_events": [
        "user_profile.enforcement_action_opened"
      ],
      "name": "name",
      "state": "disabled",
      "updated_at": "2019-12-27T18:11:19.117Z",
      "url": "url"
    }
  ],
  "has_more": true,
  "first_id": "first_id",
  "last_id": "last_id"
}
```

## Get Organization Webhook Endpoint

`$client->beta->organization->webhooks->retrieve(string webhookEndpointID, ?list<AnthropicBeta> betas): OrganizationWebhookEndpoint`

**GET** `/v1/organizations/webhooks/{webhook_endpoint_id}`

Retrieve an organization webhook endpoint by ID.

Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled.

### Parameters

- `webhookEndpointID: string` (path parameter)

  ID of the webhook endpoint.

- `betas?: optional list<AnthropicBeta>` (header parameter)

  This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header.

### Returns

- `class OrganizationWebhookEndpoint`

  - `string id`

    ID of the webhook endpoint.

  - `\Datetime createdAt`

    When the endpoint was created, in RFC 3339 format.

  - `string description`

    Notes about the endpoint. An empty string when none were given.

  - `string disabledReason`

    Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it.

  - `list<EnabledEvent> enabledEvents`

    The event types delivered to the endpoint.

  - `string name`

    A short label for the endpoint. An empty string when none was given.

  - `OrganizationWebhookEndpointState state`

    Whether deliveries are sent to the endpoint.

  - `\Datetime updatedAt`

    When the endpoint was last changed, in RFC 3339 format.

  - `string url`

    The HTTPS URL that deliveries are sent to.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Beta\AnthropicBeta;

$client = new Client(apiKey: 'my-anthropic-api-key');

$betaOrganizationWebhookEndpoint = $client
  ->beta
  ->organization
  ->webhooks
  ->retrieve(
  'webhook_endpoint_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24]
);

var_dump($betaOrganizationWebhookEndpoint);
```

#### Response (200)

```json
{
  "id": "id",
  "created_at": "2019-12-27T18:11:19.117Z",
  "description": "description",
  "disabled_reason": "disabled_reason",
  "enabled_events": [
    "user_profile.enforcement_action_opened"
  ],
  "name": "name",
  "state": "disabled",
  "updated_at": "2019-12-27T18:11:19.117Z",
  "url": "url"
}
```

## Update Organization Webhook Endpoint

`$client->beta->organization->webhooks->update(string webhookEndpointID, ?string description, ?list<EnabledEvent> enabledEvents, ?string name, ?State state, ?string url, ?list<AnthropicBeta> betas): OrganizationWebhookEndpoint`

**POST** `/v1/organizations/webhooks/{webhook_endpoint_id}`

Update an organization webhook endpoint. Only the fields you send are changed.

Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled.

### Parameters

- `webhookEndpointID: string` (path parameter)

  ID of the webhook endpoint.

- `description?: optional string`

  Notes about the endpoint.

- `enabledEvents?: optional list<EnabledEvent>`

  The event types to deliver to the endpoint. Replaces the whole set; an empty list leaves it unchanged.

- `name?: optional string`

  A short label for the endpoint.

- `state?: optional State`

  `disabled` stops deliveries. `enabled` resumes them and clears `disabled_reason`. Events that happen while the endpoint is disabled are never delivered.

- `url?: optional string`

  The HTTPS URL that deliveries are sent to.

- `betas?: optional list<AnthropicBeta>` (header parameter)

  This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header.

### Returns

- `class OrganizationWebhookEndpoint`

  - `string id`

    ID of the webhook endpoint.

  - `\Datetime createdAt`

    When the endpoint was created, in RFC 3339 format.

  - `string description`

    Notes about the endpoint. An empty string when none were given.

  - `string disabledReason`

    Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it.

  - `list<EnabledEvent> enabledEvents`

    The event types delivered to the endpoint.

  - `string name`

    A short label for the endpoint. An empty string when none was given.

  - `OrganizationWebhookEndpointState state`

    Whether deliveries are sent to the endpoint.

  - `\Datetime updatedAt`

    When the endpoint was last changed, in RFC 3339 format.

  - `string url`

    The HTTPS URL that deliveries are sent to.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Beta\AnthropicBeta;

$client = new Client(apiKey: 'my-anthropic-api-key');

$betaOrganizationWebhookEndpoint = $client
  ->beta
  ->organization
  ->webhooks
  ->update(
  'webhook_endpoint_id',
  description: 'description',
  enabledEvents: ['user_profile.enforcement_action_opened'],
  name: 'name',
  state: 'disabled',
  url: 'x',
  betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24],
);

var_dump($betaOrganizationWebhookEndpoint);
```

#### Response (200)

```json
{
  "id": "id",
  "created_at": "2019-12-27T18:11:19.117Z",
  "description": "description",
  "disabled_reason": "disabled_reason",
  "enabled_events": [
    "user_profile.enforcement_action_opened"
  ],
  "name": "name",
  "state": "disabled",
  "updated_at": "2019-12-27T18:11:19.117Z",
  "url": "url"
}
```

## Delete Organization Webhook Endpoint

`$client->beta->organization->webhooks->delete(string webhookEndpointID, ?list<AnthropicBeta> betas): DeletedOrganizationWebhookEndpoint`

**DELETE** `/v1/organizations/webhooks/{webhook_endpoint_id}`

Delete an organization webhook endpoint.

Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled.

### Parameters

- `webhookEndpointID: string` (path parameter)

  ID of the webhook endpoint.

- `betas?: optional list<AnthropicBeta>` (header parameter)

  This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header.

### Returns

- `class DeletedOrganizationWebhookEndpoint`

  - `"webhook_endpoint_deleted" type`

    Always `webhook_endpoint_deleted`.

  - `string id`

    ID of the deleted webhook endpoint.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Beta\AnthropicBeta;

$client = new Client(apiKey: 'my-anthropic-api-key');

$betaDeletedOrganizationWebhookEndpoint = $client
  ->beta
  ->organization
  ->webhooks
  ->delete(
  'webhook_endpoint_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24]
);

var_dump($betaDeletedOrganizationWebhookEndpoint);
```

#### Response (200)

```json
{
  "id": "id",
  "type": "webhook_endpoint_deleted"
}
```

## Regenerate Organization Webhook Endpoint Signing Secret

`$client->beta->organization->webhooks->regenerateSigningSecret(string webhookEndpointID, ?list<AnthropicBeta> betas): OrganizationWebhookEndpointSigningSecret`

**POST** `/v1/organizations/webhooks/{webhook_endpoint_id}/regenerate_signing_secret`

Replace an organization webhook endpoint's signing secret. The old secret stops
working immediately. The new secret is returned only in this response.

Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled.

### Parameters

- `webhookEndpointID: string` (path parameter)

  ID of the webhook endpoint.

- `betas?: optional list<AnthropicBeta>` (header parameter)

  This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header.

### Returns

- `class OrganizationWebhookEndpointSigningSecret`

  - `string signingSecret`

    The new signing secret. Deliveries are signed with it from now on, and no other response returns it.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Beta\AnthropicBeta;

$client = new Client(apiKey: 'my-anthropic-api-key');

$betaOrganizationWebhookEndpointSigningSecret = $client
  ->beta
  ->organization
  ->webhooks
  ->regenerateSigningSecret(
  'webhook_endpoint_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24]
);

var_dump($betaOrganizationWebhookEndpointSigningSecret);
```

#### Response (200)

```json
{
  "signing_secret": "signing_secret"
}
```

## Domain types

### Beta Deleted Organization Webhook Endpoint

- `class DeletedOrganizationWebhookEndpoint`

  - `"webhook_endpoint_deleted" type`

    Always `webhook_endpoint_deleted`.

  - `string id`

    ID of the deleted webhook endpoint.

### Beta New Organization Webhook Endpoint

- `class NewOrganizationWebhookEndpoint`

  - `string id`

    ID of the webhook endpoint.

  - `\Datetime createdAt`

    When the endpoint was created, in RFC 3339 format.

  - `string description`

    Notes about the endpoint. An empty string when none were given.

  - `string disabledReason`

    Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it.

  - `list<EnabledEvent> enabledEvents`

    The event types delivered to the endpoint.

  - `string name`

    A short label for the endpoint. An empty string when none was given.

  - `string signingSecret`

    The secret Anthropic signs deliveries to the endpoint with (prefix `whsec_`). No other response returns it, so store it now. To replace it, regenerate the signing secret.

  - `OrganizationWebhookEndpointState state`

    Whether deliveries are sent to the endpoint.

  - `\Datetime updatedAt`

    When the endpoint was last changed, in RFC 3339 format.

  - `string url`

    The HTTPS URL that deliveries are sent to.

### Beta Organization Webhook Endpoint

- `class OrganizationWebhookEndpoint`

  - `string id`

    ID of the webhook endpoint.

  - `\Datetime createdAt`

    When the endpoint was created, in RFC 3339 format.

  - `string description`

    Notes about the endpoint. An empty string when none were given.

  - `string disabledReason`

    Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it.

  - `list<EnabledEvent> enabledEvents`

    The event types delivered to the endpoint.

  - `string name`

    A short label for the endpoint. An empty string when none was given.

  - `OrganizationWebhookEndpointState state`

    Whether deliveries are sent to the endpoint.

  - `\Datetime updatedAt`

    When the endpoint was last changed, in RFC 3339 format.

  - `string url`

    The HTTPS URL that deliveries are sent to.

### Beta Organization Webhook Endpoint Signing Secret

- `class OrganizationWebhookEndpointSigningSecret`

  - `string signingSecret`

    The new signing secret. Deliveries are signed with it from now on, and no other response returns it.

### Beta Organization Webhook Endpoint State

- `enum OrganizationWebhookEndpointState`

  - `"disabled"`

  - `"enabled"`